3

If I ban a user from a website indefinitely (specific manual ban not automatic), and they'll never be able to appeal, should I verify the user's email and password, or show them that they're banned using their email only?

Here are the downsides to each:

  • Verify Email Only: The fact that the user is banned will be known to anyone using their email to log in.
  • Verify Email and Password: The user will forget about the account, and someone might come to the website and try out a password to make sure it is used by the user.
Improve this question

2 Answers 2

Reset to default
2

This is more a security/privacy question but that often touches the UX too.

You should verify e-mail and password for the same reasons you do that for all users. If a user tries to log in with a non-registered e-mail address and it tells that the e-mail address was not found, that is a potential security and privacy risk.

You can show that the user is banned only when the e-mail and password combination is correct. When banned users forget their password, treat them the same as other users and let them reset the password by sending them an e-mail. In that e-mail you can mention that it is not possible to reset the password because they have been banned from the site.

Improve this answer
-1

It doesn't matter at all

Unless you have a strange user case with a 2 step flow (mail first / password second), the validation will come after the user completes both fields and submits the form. You can validate with autocomplete, but that would be a security issue, so I assume you will do it like everyone else.

About your disadvantages:

  • Check email only: the fact that the user is banned will be known by anyone who uses their email to log in.

Why worry? Banned someone and worried that someone is trying to illegally use someone else's account? Neither of them is your user, they are both breaking your rules, why do you care about them and their feelings?

  • Verify email and password: The user will forget the account and it is possible for someone to access the website and test a password to make sure it is used by the user.

I'm not sure I have understood this correctly: on the one hand, it would be the same case (someone else trying to break your security measures using the credentials of an already banned person). Otherwise the only reason for this would be a super weird and extreme extreme case, like 1 in 1 million. But again: I'm not sure what you mean exactly.

In short

If the banned user tries to enter the site, just show him a notice after he tried. It's a proven pattern, no reason to change it.

Improve this answer
4
  • "Why worry?" privacy. Just because a user is banned you shouldn't share that information with everyone knowing their email. Thats not their business. its only the legitimate accounts owners business if the account is banned or not.
    – Polygnome
    Apr 27, 2021 at 8:04
  • sorry, who is sharing anything? Please point where in my answer did I say that, or where in the question the OP even implies that situation. You might be against proven patterns that everybody does (and did for years), and that's OK, it's your decision. But please don't put words in my mouth
    – Devin
    Apr 27, 2021 at 17:15
  • 1
    If you do not check the password, but only the email address, then you are leaking/sharing information about the state of the account to everyone who merely knows the email address - which isn't secret. Its bad practice to give out any information - even such basic information if an account exists at all if the user cannot authenticate.
    – Polygnome
    Apr 27, 2021 at 17:34
  • ok, there you have your like
    – Devin
    Apr 27, 2021 at 22:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.